clearotron 0.5.0-beta.6 → 0.5.0-beta.7

package/THIRD-PARTY-NOTICES.md

@@ -9,7 +9,7 @@ file rather than a courtesy.
 production tree; `--check` fails when it no longer matches. Development dependencies are excluded:
 they are not distributed, so they carry no obligation for anyone who installs this.
 
-178 packages.
+176 packages.
 
 > **Declared but NOT INSTALLED, so not distributed and not attributed below:** `@cfworker/json-schema`.
 > npm lists these with no version and no path — an unmet or optional peer. Recorded because a name
@@ -110,6 +110,69 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
+## @isaacs/nonrecursive-glob-match@1.0.3
+
+- **Licence declared:** `BlueOak-1.0.0`
+- **Licence file:** `LICENSE.md`
+
+```
+# Blue Oak Model License
+
+Version 1.0.0
+
+## Purpose
+
+This license gives everyone as much permission to work with
+this software as possible, while protecting contributors
+from liability.
+
+## Acceptance
+
+In order to receive this license, you must agree to its
+rules.  The rules of this license are both obligations
+under that agreement and conditions to your license.
+You must not do anything with this software that triggers
+a rule that you cannot or will not follow.
+
+## Copyright
+
+Each contributor licenses you to do everything with this
+software that would otherwise infringe that contributor's
+copyright in it.
+
+## Notices
+
+You must ensure that everyone who gets a copy of
+any part of this software from you, with or without
+changes, also gets the text of this license or a link to
+<https://blueoakcouncil.org/license/1.0.0>.
+
+## Excuse
+
+If anyone notifies you in writing that you have not
+complied with [Notices](#notices), you can keep your
+license by taking all practical steps to comply within 30
+days after the notice.  If you do not do so, your license
+ends immediately.
+
+## Patent
+
+Each contributor licenses you to do everything with this
+software that would otherwise infringe any patent claims
+they can license or become able to license.
+
+## Reliability
+
+No contributor can revoke this license.
+
+## No Liability
+
+***As far as the law allows, this software comes as is,
+without any warranty or condition, and no contributor
+will be liable to anyone for any damages related to this
+software or this license, under any kind of legal claim.***
+```
+
 ## @modelcontextprotocol/sdk@1.32.1
 
 - **Licence declared:** `MIT`
@@ -383,7 +446,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 ```
 
-## balanced-match@1.0.2
+## balanced-match@4.0.4
 
 - **Licence declared:** `MIT`
 - **Repository:** git://github.com/juliangruber/balanced-match
@@ -392,7 +455,9 @@ THE SOFTWARE.
 ```
 (MIT)
 
-Copyright (c) 2013 Julian Gruber &lt;julian@juliangruber.com&gt;
+Original code Copyright Julian Gruber <julian@juliangruber.com>
+
+Port to TypeScript Copyright Isaac Z. Schlueter <i@izs.me>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the "Software"), to deal in
@@ -566,46 +631,18 @@ TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ```
 
-## brace-expansion@1.1.21
+## brace-expansion@5.0.12
 
 - **Licence declared:** `MIT`
-- **Repository:** git://github.com/juliangruber/brace-expansion
+- **Repository:** https://github.com/juliangruber/brace-expansion
 - **Licence file:** `LICENSE`
 
 ```
 MIT License
 
-Copyright (c) 2013 Julian Gruber <julian@juliangruber.com>
+Copyright Julian Gruber <julian@juliangruber.com>
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-```
-
-## brace-expansion@2.1.7
-
-- **Licence declared:** `MIT`
-- **Repository:** git://github.com/juliangruber/brace-expansion
-- **Licence file:** `LICENSE`
-
-```
-MIT License
-
-Copyright (c) 2013 Julian Gruber <julian@juliangruber.com>
+TypeScript port Copyright Isaac Z. Schlueter <i@izs.me>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -843,33 +880,6 @@ FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
 OTHER DEALINGS IN THE SOFTWARE.
 ```
 
-## concat-map@0.0.1
-
-- **Licence declared:** `MIT`
-- **Repository:** git://github.com/substack/node-concat-map
-- **Licence file:** `LICENSE`
-
-```
-This software is released under the MIT license:
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of
-this software and associated documentation files (the "Software"), to deal in
-the Software without restriction, including without limitation the rights to
-use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
-the Software, and to permit persons to whom the Software is furnished to do so,
-subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
-FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
-COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
-IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
-CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-```
-
 ## content-disposition@1.1.0
 
 - **Licence declared:** `MIT`
@@ -4415,52 +4425,68 @@ TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ```
 
-## minimatch@3.1.5
+## minimatch@11.0.3
 
-- **Licence declared:** `ISC`
-- **Repository:** git://github.com/isaacs/minimatch
-- **Licence file:** `LICENSE`
+- **Licence declared:** `BlueOak-1.0.0`
+- **Repository:** git@github.com:isaacs/minimatch
+- **Licence file:** `LICENSE.md`
 
 ```
-The ISC License
+# Blue Oak Model License
 
-Copyright (c) Isaac Z. Schlueter and Contributors
+Version 1.0.0
 
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
+## Purpose
 
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-```
+This license gives everyone as much permission to work with
+this software as possible, while protecting contributors
+from liability.
 
-## minimatch@5.1.9
+## Acceptance
 
-- **Licence declared:** `ISC`
-- **Repository:** git://github.com/isaacs/minimatch
-- **Licence file:** `LICENSE`
+In order to receive this license, you must agree to its
+rules. The rules of this license are both obligations
+under that agreement and conditions to your license.
+You must not do anything with this software that triggers
+a rule that you cannot or will not follow.
 
-```
-The ISC License
+## Copyright
 
-Copyright (c) Isaac Z. Schlueter and Contributors
+Each contributor licenses you to do everything with this
+software that would otherwise infringe that contributor's
+copyright in it.
 
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
+## Notices
 
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+You must ensure that everyone who gets a copy of
+any part of this software from you, with or without
+changes, also gets the text of this license or a link to
+<https://blueoakcouncil.org/license/1.0.0>.
+
+## Excuse
+
+If anyone notifies you in writing that you have not
+complied with [Notices](#notices), you can keep your
+license by taking all practical steps to comply within 30
+days after the notice. If you do not do so, your license
+ends immediately.
+
+## Patent
+
+Each contributor licenses you to do everything with this
+software that would otherwise infringe any patent claims
+they can license or become able to license.
+
+## Reliability
+
+No contributor can revoke this license.
+
+## No Liability
+
+**_As far as the law allows, this software comes as is,
+without any warranty or condition, and no contributor
+will be liable to anyone for any damages related to this
+software or this license, under any kind of legal claim._**
 ```
 
 ## minimist@1.2.8

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "c4d6c8b42431a476839b819ac5181e09fb6c1cf1",
-  "version": "0.5.0-beta.6"
+  "commit": "918c71c56484cf580cd12b2722b71f1ec54e873d",
+  "version": "0.5.0-beta.7"
 }

package/docs/architecture/04-configuration-reference.md

@@ -78,7 +78,7 @@ does after the stage's full retry ladder fails ([03 §5](03-run-lifecycle.md#5--
 | 3 | `blind-frame` | opus · high | 600 / 450 | `blind-frame-model.json` (strict-parsed; the prose twin was retired 2026-08-03 — nothing read it) | non-fatal (frame-diff skipped this run) |
 | 4 | `common-law` | haiku · low | 2250 / 1100 | `common-law-findings.md` (+ grid ledger, plugin-written) | fatal at fan-in |
 | 5 | `common-law-half` | per seat: `COMMON_LAW_SEAT_TIER` — halves `a`/`b` haiku · low; meaning seat `m` `CLEAROTRON_MEANING_SEAT_MODEL` \|\| haiku · low | 2250 / 1100 | `common-law-findings.half-{a,b,m}.md` (+ per-seat grid ledgers) | fatal at fan-in; one-half transient quarantine allowed |
-| 6 | `register-unit` | per axis: `saturation-probe` haiku · off; sweeps sonnet · adaptive | 1500 / 1100 | `register-units/<axis>.md` + `<axis>-band.json` (plan mode: tool-written, qid-stamped) | fatal at fan-in (after band-vocabulary quarantine / collapsed-band repair) |
+| 6 | `register-unit` | per axis: `primary-sweep` opus · adaptive (`PRIMARY_SWEEP_TIER`, from 2026-10-30); `transliteration-numeric` and `incumbent-class` sonnet · adaptive; `saturation-probe` haiku · off | 1500 / 1100 | `register-units/<axis>.md` + `<axis>-band.json` (plan mode: tool-written, qid-stamped) | fatal at fan-in (after band-vocabulary quarantine / collapsed-band repair) |
 | 7 | `placement-inquiry` | opus · high | 2700 / 600 | `placement-recommendations.md` | fatal |
 | 8 | `register-digest` | opus · **low** (was high until 2026-08-01 — 3.49× wall/output against a 1.03× fixed-effort control, with no detectable effect on which records it tiers; override an arm with `CLEAROTRON_STAGE_THINKING`) | 2400 / 900 | `register-findings.md` (coverage-ledger JSON is code-derived from its prose) | fatal (every digest pass) |
 | 9 | `skeptic` | sonnet · high | 600 / 600 | `skeptic-flags.md` (verbatim `ESCALATE: <axis>` lines) | non-fatal (no escalation on failure) |

package/driver/CHANGELOG.md

@@ -1,5 +1,16 @@
 # clearotron-driver
 
+## 0.5.0-beta.7
+
+### Patch Changes
+
+- Fixed: When deciding whether a wider register search is worth running, the engine now uses its strongest model, so a conflict found only by a wider search is no longer skipped.
+- Fixed: A search the register refused is now recorded with the register's own reason, and a search the engine itself declined to send is no longer reported as a register error.
+- Fixed: A run repaired after a failure now keeps the original order, including who sent it and their instructions, instead of rebuilding a partial one.
+- Fixed: An overview that cites a finding no longer in the report is now sent back for correction before delivery, and flagged for the reviewing lawyer if the citation remains.
+- Fixed: The audit now states in plain words why each unsearched question was not carried out.
+- Fixed: The reviewing step now sees every conflict the writer set aside, with the writer's reason, and can send one back for correction.
+
 ## 0.5.0-beta.6
 
 ### Patch Changes

package/driver/accepted-order.mjs

@@ -0,0 +1,139 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// accepted-order.mjs — the order a run was accepted on, kept with the run from intake, and the job a resume or a
+// stage replay rebuilds from it.
+//
+// THE DEFECT. The queue entry carrying an order is consumed when its run starts, and the run kept only what status.json
+// and the instructed scope hold: its identity, the marks by name, the goods, the applicant and the territories. A run
+// repaired with `--resume` was rebuilt without the order's delivery routing, so its delivery packet named no forwarder
+// address and no message to answer, and a stage replayed with `--experiment` lost the stated use, the campaign facts and
+// the requester's instructions. A run that failed before delivering keeps the routing nowhere else, and that is the run
+// a resume repairs.
+//
+// SO THE RUN KEEPS ITS ORDER WHOLE, at intake, before any stage can fail: `_driver/accepted-order.json`, written once and
+// never rewritten. A resume or replay that is given no job file reconstructs the order from it. An order given again
+// explicitly, by a resume with `--job`, that differs from the original is kept beside it as an amendment; the original
+// stays. The file is private run data like the rest of the run directory. No stage's context lists it: no model needs
+// the routing.
+//
+// AN OLDER RUN HAS NO SUCH FILE. For it the order is taken from the run's own queue entry where that survives, matched
+// by the order's id and checked against the run's frozen scope and account: a conflict refuses the queue entry whole,
+// never field by field. Taken from there, it is kept as the run's accepted order, so the run no longer depends on the
+// queue entry. Where neither survives, the job is rebuilt from status as before, and the fields only the order held are
+// named as unrecovered, internally: nothing is invented in their place, no address is borrowed from the account or
+// another order, and a replay on such a job is not a faithful one.
+
+import { existsSync, readFileSync, appendFileSync } from "node:fs";
+import { join } from "node:path";
+import { driverDir, ensureDriverDir } from "../shared/driver-dir.mjs";
+import { atomicWrite } from "./progress.mjs";
+
+export const ACCEPTED_ORDER_FILE = "accepted-order.json";
+export const ORDER_AMENDMENTS_FILE = "order-amendments.jsonl";
+export const ORDER_RECOVERY_FILE = "order-recovery.json";
+
+/** The fields only the order holds: what a rebuild from status cannot say. Each mark entry's own `ref` and `classes`
+ *  are named as `marks[].ref` and `marks[].classes`. */
+export const ORDER_ONLY_FIELDS = Object.freeze(["forwarderEmail", "msgId", "conversationId", "clientPrincipal",
+  "priorUse", "campaignShape", "upfrontInstructions", "marks[].ref", "marks[].classes"]);
+
+/** A copy of the order as it was accepted, untouched by anything the run does to its job later. null for no order. PURE. */
+export function orderSnapshot(job) {
+  if (!job || typeof job !== "object" || Array.isArray(job)) return null;
+  try { return JSON.parse(JSON.stringify(job)); } catch { return null; }
+}
+
+const readJson = (file) => { try { return existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : null; } catch { return null; } };
+const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+
+/** The order this run was accepted on, or null when the run holds none (an older run, or an unreadable file). */
+export function readAcceptedOrder(runDir) {
+  const rec = readJson(driverDir(String(runDir ?? ""), ACCEPTED_ORDER_FILE));
+  return rec?.order && typeof rec.order === "object" ? rec.order : null;
+}
+
+/**
+ * Keep the order with the run. The first order a run is given is written and never rewritten. A later order changes
+ * nothing unless it was given explicitly (`explicit`, a job file on a resume) and differs from the original and from
+ * the last amendment; then it is appended as an amendment. A job rebuilt by this run's own resume is never kept as the
+ * accepted order (`rebuilt`): a reconstruction is not the order. `from` names where a written order came from.
+ * Returns what it did: "written", "amended", "kept", or "not-kept".
+ */
+export function retainAcceptedOrder(runDir, order, { explicit = false, rebuilt = false, from = "intake", now = () => new Date().toISOString() } = {}) {
+  if (!runDir || !order) return "not-kept";
+  const file = driverDir(runDir, ACCEPTED_ORDER_FILE);
+  const original = readAcceptedOrder(runDir);
+  if (!original) {
+    if (rebuilt || existsSync(file)) return "not-kept";   // an unreadable file is the run's record still: never replaced
+    ensureDriverDir(runDir);
+    atomicWrite(file, JSON.stringify({ ts: now(), from, order }, null, 2) + "\n");
+    return "written";
+  }
+  if (!explicit || rebuilt || same(order, original)) return "kept";
+  const amendments = driverDir(runDir, ORDER_AMENDMENTS_FILE);
+  let last = null;
+  try { last = readFileSync(amendments, "utf8").split("\n").filter(Boolean).map((l) => JSON.parse(l)).pop()?.order ?? null; } catch { /* none yet */ }
+  if (last && same(order, last)) return "kept";
+  appendFileSync(amendments, JSON.stringify({ ts: now(), order }) + "\n");
+  return "amended";
+}
+
+/** The run's retained queue entry for order `id`: a finished one (`.done`) or a failed one (`.failed`). null when
+ *  neither survives or it does not hold that order. */
+export function retainedQueueOrder(queueDir, id) {
+  if (!queueDir || !id || /[\\/]/.test(String(id))) return null;
+  for (const end of [".done", ".failed"]) {
+    const order = readJson(join(queueDir, `${id}${end}`));
+    if (order && typeof order === "object" && order.id === id) return order;
+  }
+  return null;
+}
+
+/**
+ * Why a retained queue entry is not this run's order, or null when it agrees with everything the run froze of its
+ * order: its identity in status, its instructed scope (read through `scopeOf`, the run's own reading of a job), and the
+ * account in its frozen profile where the order named one. PURE.
+ */
+export function queueOrderConflict(order, { status = null, scope = null, profile = null, scopeOf } = {}) {
+  for (const k of ["id", "ref", "markName"])
+    if (status?.[k] != null && order?.[k] != null && String(status[k]) !== String(order[k])) return `its ${k} differs from the run's`;
+  if (scope && typeof scopeOf === "function") {
+    const theirs = scopeOf(order);
+    for (const k of ["marks", "classes", "jurisdictions", "goods", "customer"])
+      if (!same(theirs?.[k] ?? null, scope?.[k] ?? null)) return `its ${k === "customer" ? "applicant" : k} differs from the run's instructed scope`;
+  }
+  if (typeof order?.profileKey === "string" && order.profileKey && typeof profile?.profileKey === "string" && profile.profileKey
+    && order.profileKey !== profile.profileKey) return "its account differs from the run's frozen profile";
+  return null;
+}
+
+/**
+ * The job a resume or replay given no job file runs on, and where it came from:
+ *   - "accepted-order": the order the run kept at intake, whole;
+ *   - "queue-order": an older run's retained queue entry, matched and checked, then kept as the run's accepted order;
+ *   - "status": neither survives, or the queue entry conflicts; the job is `fromStatus()`, and `unrecovered` names the
+ *     fields only the order held.
+ * `conflict` says why a queue entry was refused. A resume (`write`) records the answer in `_driver/order-recovery.json`,
+ * field names and never values, and keeps a matched queue entry as the run's order; a stage replay writes nothing into
+ * the run it studies, and its receipt carries the answer instead.
+ */
+export function rebuildRunOrder({ runDir, status = null, scope = null, profile = null, queueDir = null, scopeOf, fromStatus, write = true, now = () => new Date().toISOString() }) {
+  let out;
+  const accepted = readAcceptedOrder(runDir);
+  if (accepted) out = { job: accepted, source: "accepted-order", unrecovered: [], conflict: null };
+  else {
+    const queued = retainedQueueOrder(queueDir, status?.id);
+    const conflict = queued ? queueOrderConflict(queued, { status, scope, profile, scopeOf }) : null;
+    if (queued && !conflict) {
+      if (write) retainAcceptedOrder(runDir, orderSnapshot(queued), { from: "queue-order", now });
+      out = { job: queued, source: "queue-order", unrecovered: [], conflict: null };
+    } else out = { job: fromStatus(), source: "status", unrecovered: [...ORDER_ONLY_FIELDS], conflict };
+  }
+  if (write) try {
+    ensureDriverDir(runDir);
+    atomicWrite(driverDir(runDir, ORDER_RECOVERY_FILE), JSON.stringify({ ts: now(), source: out.source,
+      unrecovered: out.unrecovered, conflict: out.conflict, faithful: out.unrecovered.length === 0 }, null, 2) + "\n");
+  } catch { /* the caller says where the job came from either way */ }
+  return out;
+}